@devdogsuga/devtools 0.1.25 → 0.1.27

package/dist/persona.js

@@ -1,221 +0,0 @@
-/**
- * `persona <member|moderator>` / `persona --clean` — throwaway accounts for
- * a development database.
- *
- * These replace the seeded `member@devdogs.test` / `author@devdogs.test` /
- * `moderator@devdogs.test` personas that used to come from
- * `supabase/seed/development/02_moderation.sql`. That file — and the rest of
- * `supabase/seed/development/` — is going away in the app repo, so a fresh
- * `db reset` no longer leaves a signed-in account to switch to; this is what
- * creates one on demand instead.
- *
- * Every account this creates lives at `<kind>-<8 hex>@persona.test`: a
- * domain that cannot collide with a real UGA address, and — not
- * coincidentally — the same reason it can exist here at all. `.createUser`
- * goes through GoTrue's ADMIN API, which inserts the row directly rather
- * than running the app's `before_user_created` Auth Hook (the one that
- * requires a uga.edu address on the sign-up/OTP paths a real member takes).
- * The admin API was never wired to that hook, so a `@persona.test` address
- * sails through here uncontested.
- *
- * `--clean` deletes every account this command created — matched on BOTH the
- * `@persona.test` domain AND a `user_metadata.createdBy` marker, never the
- * domain alone. A shared development database can carry `@persona.test`
- * accounts this command did not create — CI's own fixtures, most likely, or
- * a `moderation check` run whose `withTemporaryModerator` teardown never
- * reached its `finally` because the process was killed. The marker is what
- * keeps `--clean` from reaching past accounts it is not responsible for.
- */
-import { randomUUID } from "node:crypto";
-import { confirm, log, note, select } from "@clack/prompts";
-import { adminClient, resolveInstance } from "./instance.js";
-import { grantModerator } from "./moderation.js";
-import { explain, unwrap } from "./ui.js";
-export const PERSONA_KINDS = ["member", "moderator"];
-export function isPersonaKind(value) {
-    return PERSONA_KINDS.includes(value);
-}
-/** Every account this command creates carries this in `user_metadata`, and
- * `--clean` refuses to delete anything without it — see the header. */
-const CREATED_BY = "devtools persona";
-function personaEmail(kind) {
-    return `${kind}-${randomUUID().slice(0, 8)}@persona.test`;
-}
-/** Nobody needs to remember this — it is printed once, for whoever asked. */
-function randomPassword() {
-    return randomUUID() + randomUUID();
-}
-/**
- * Refuses outside development — a staging or production database has real
- * members on it, and this command exists to populate one that does not.
- * Exported so `cli.ts`'s `moderation check` (also development-only now, for
- * the same reason) shares the exact refusal wording.
- */
-export function refuseUnlessDevelopment(connection, label) {
-    if (connection.tier === "development")
-        return false;
-    process.stderr.write(`${label}: only runs against a development database — this session ` +
-        `targets ${connection.tier}. Relaunch with --tier development:local ` +
-        "or development:remote.\n");
-    return true;
-}
-/**
- * Creates the account and its profile — `userId` and `preferredName` are the
- * only two columns `platform.profile` requires (see the migration; every
- * other column is nullable or defaulted), which is why this needs nothing
- * from `02_moderation.sql`'s richer INSERT beyond the shape of the two rows
- * it wrote. Grants the Moderator role too, for `kind === "moderator"`.
- */
-async function createPersona(instance, kind) {
-    const admin = adminClient(instance);
-    const email = personaEmail(kind);
-    const password = randomPassword();
-    const preferredName = kind === "moderator" ? "Devtools Moderator" : "Devtools Member";
-    const { data, error } = await admin.auth.admin.createUser({
-        email,
-        password,
-        email_confirm: true,
-        user_metadata: { createdBy: CREATED_BY },
-    });
-    if (error || !data.user) {
-        throw new Error(`Could not create the account: ${error?.message}`);
-    }
-    const userId = data.user.id;
-    const { error: profileErr } = await admin
-        .from("profile")
-        .insert({ userId, preferredName });
-    if (profileErr) {
-        throw new Error(`Could not create a profile: ${profileErr.message}`);
-    }
-    if (kind === "moderator")
-        await grantModerator(admin, userId);
-    return { email, password, userId, preferredName };
-}
-/** Any OTHER profile on this database, for a moderator persona to report —
- * `null` when this is the only account around, which the caller reports
- * rather than guessing at a subject that does not exist. */
-async function findOtherProfile(instance, excludeUserId) {
-    const { data, error } = await adminClient(instance)
-        .from("profile")
-        .select("userId, preferredName")
-        .neq("userId", excludeUserId)
-        .limit(1)
-        .maybeSingle();
-    if (error)
-        throw new Error(`Could not read platform.profile: ${error.message}`);
-    return data;
-}
-/**
- * Files one open report, mirroring the "one open report" `02_moderation.sql`
- * used to seed — inserted directly rather than through
- * `platform.file_report()`, the same reasoning that seed's own comment gave:
- * neither a seed nor this command has a session to attribute the RPC call to.
- */
-async function fileSampleReport(instance, reporterId, subjectId, subjectName) {
-    const admin = adminClient(instance);
-    const { data: app, error: appErr } = await admin
-        .from("apps")
-        .select("id")
-        .eq("slug", "platform")
-        .single();
-    if (appErr || !app) {
-        throw new Error(`Could not find the platform app row: ${appErr?.message}`);
-    }
-    const { error } = await admin.from("reports").insert({
-        appId: app.id,
-        reporterUserId: reporterId,
-        reportedUserId: subjectId,
-        contentType: "profile",
-        contentRef: subjectId,
-        contentSnapshot: subjectName,
-        description: "Filed by `pnpm devtools persona` so the moderation queue has something in it.",
-        reason: "spam",
-    });
-    if (error) {
-        throw new Error(`Could not file the sample report: ${error.message}`);
-    }
-}
-async function runClean(instance) {
-    const admin = adminClient(instance);
-    const { data, error } = await admin.auth.admin.listUsers();
-    if (error)
-        throw new Error(`Could not list accounts: ${error.message}`);
-    // Both conditions — see the header on why the domain alone is not enough.
-    const targets = data.users.filter((u) => u.email?.endsWith("@persona.test") &&
-        u.user_metadata?.createdBy === CREATED_BY);
-    if (targets.length === 0) {
-        log.info("No `pnpm devtools persona`-created accounts to clean up.");
-        return;
-    }
-    // Deleting the auth user cascades to its profile, its Moderator role grant
-    // (if any) and any reports it filed or was reported in — every FK a
-    // persona account touches is `on delete cascade` — so there is nothing
-    // else to clean up per account.
-    for (const user of targets) {
-        await admin.auth.admin.deleteUser(user.id);
-        log.success(`Deleted ${user.email}.`);
-    }
-    log.info(`Deleted ${targets.length} account${targets.length === 1 ? "" : "s"}.`);
-}
-export async function runPersona(argv) {
-    const clean = argv.includes("--clean");
-    const positional = argv.find((arg) => !arg.startsWith("--"));
-    if (clean && positional) {
-        explain("Two answers to one question.", "--clean deletes every account this command made; a kind creates a new one.", ["pnpm devtools persona member", "pnpm devtools persona --clean"]);
-        process.exitCode = 1;
-        return;
-    }
-    const resolved = await resolveInstance({ label: "devtools persona" });
-    if (!resolved) {
-        process.exitCode = 1;
-        return;
-    }
-    const { connection, instance } = resolved;
-    if (refuseUnlessDevelopment(connection, "devtools persona")) {
-        process.exitCode = 1;
-        return;
-    }
-    if (clean) {
-        await runClean(instance);
-        return;
-    }
-    let kind;
-    if (positional) {
-        if (!isPersonaKind(positional)) {
-            explain(`"${positional}" is not a persona kind.`, "", [
-                "pnpm devtools persona member",
-                "pnpm devtools persona moderator",
-            ]);
-            process.exitCode = 1;
-            return;
-        }
-        kind = positional;
-    }
-    else {
-        kind = unwrap(await select({
-            message: "Which kind of persona?",
-            options: PERSONA_KINDS.map((value) => ({ value, label: value })),
-        }));
-    }
-    const persona = await createPersona(instance, kind);
-    note(`Email:    ${persona.email}\nPassword: ${persona.password}`, `${kind} persona created`);
-    const fileReport = unwrap(await confirm({
-        message: "File a sample report against a member profile, so the moderation queue isn't empty?",
-        initialValue: kind === "moderator",
-    }));
-    if (!fileReport)
-        return;
-    // A member persona reports itself — there is no separate reporter account
-    // on offer here, and nothing downstream cares who filed it, only that the
-    // queue has one open report to practice resolving. A moderator persona
-    // reports whatever OTHER profile already exists.
-    const subject = kind === "member"
-        ? { userId: persona.userId, preferredName: persona.preferredName }
-        : await findOtherProfile(instance, persona.userId);
-    if (!subject) {
-        log.warn("No other account to report yet — run `pnpm devtools persona member` first.");
-        return;
-    }
-    await fileSampleReport(instance, persona.userId, subject.userId, subject.preferredName);
-    log.success("Filed a sample report. Resolve it from /console/moderation.");
-}

package/dist/pick.d.ts

@@ -1,6 +0,0 @@
-import type { VaultTarget } from "@devdogsuga/env";
-/**
- * `null` means the failure has already been explained; set an exit code and
- * stop. It is not the same as a cancel, which exits the process outright.
- */
-export declare function resolveVaultTarget(given: string | undefined, message: string): Promise<VaultTarget | null>;

package/dist/pick.js

@@ -1,64 +0,0 @@
-/**
- * Choosing a target when the command line did not name one.
- *
- * `--target` is optional, and when it is absent this asks rather than guessing.
- * There is no safe default to fall back to, because the targets differ
- * precisely in how much damage picking the wrong one does.
- *
- * Three properties the prompt is built around:
- *
- *   * Production is never the highlighted option. The list is ordered least-
- *     to most-dangerous (that order lives in the target table), so a reflexive
- *     Enter selects `preflight`.
- *   * It refuses to prompt where nobody can answer. A prompt on a
- *     non-interactive stdin hangs until the job times out, which reads as a
- *     broken tool rather than a missing argument.
- *   * `development` is refused by name, not by silence. It is a real target
- *     with a file, and it is the one target with no Bitwarden project, so
- *     `pull`/`push`/`audit` cannot do anything with it. Letting it fall into
- *     "not a target" would say something false; the message says which fact
- *     rules it out.
- */
-import { select } from "@clack/prompts";
-import { loadEnv } from "./repo/peers.js";
-import { noVaultProjectHints, NoVaultProjectError, } from "./bws/environments.js";
-import { explain, unwrap } from "./ui.js";
-/** Short enough to sit beside the name; the specs' summaries are paragraphs. */
-const VAULT_HINTS = {
-    preflight: "read-only credentials for the pre-promotion checks",
-    staging: "the everyday one — safe to overwrite",
-    production: "⚠️  the live values",
-};
-/**
- * `null` means the failure has already been explained; set an exit code and
- * stop. It is not the same as a cancel, which exits the process outright.
- */
-export async function resolveVaultTarget(given, message) {
-    const { ENV_TARGETS, VAULT_TARGETS, isEnvTarget, isVaultTarget } = await loadEnv();
-    if (given !== undefined) {
-        if (isVaultTarget(given))
-            return given;
-        if (isEnvTarget(given)) {
-            explain(new NoVaultProjectError(given).message, "", noVaultProjectHints());
-            return null;
-        }
-        explain(`"${given}" is not a target.`, "", [
-            `Try one of: ${ENV_TARGETS.join(", ")}`,
-            `Only ${VAULT_TARGETS.join(", ")} have a Bitwarden project.`,
-        ]);
-        return null;
-    }
-    if (!process.stdin.isTTY) {
-        explain("No target given, and there is nobody here to ask.", "", [
-            `Pass --target: ${VAULT_TARGETS.join(" | ")}`,
-        ]);
-        return null;
-    }
-    return unwrap(await select({
-        message,
-        options: VAULT_TARGETS.map((value) => ({
-            value,
-            hint: VAULT_HINTS[value],
-        })),
-    }));
-}

package/dist/pipes.d.ts

@@ -1 +0,0 @@
-export declare function ignoreClosedPipes(): void;

package/dist/pipes.js

@@ -1,25 +0,0 @@
-/**
- * Keeps a closed stdout/stderr from crashing devtools.
- *
- * When whatever reads devtools' output goes away first (`devtools … | head`,
- * or a wrapper that stopped listening), the next write fails with EPIPE. The
- * stream emits that as an `'error'` event nobody handles, so Node throws it as
- * an uncaught exception and Sentry files it as a fatal. Nobody is left to read
- * the output, so dropping it is the right outcome. Any other stream error is
- * rethrown and crashes as it did before.
- *
- * Idempotent, because `launch`, `launchCi` and `ci.ts`'s `main` can all run in
- * one process.
- */
-let installed = false;
-export function ignoreClosedPipes() {
-    if (installed)
-        return;
-    installed = true;
-    for (const stream of [process.stdout, process.stderr]) {
-        stream.on("error", (err) => {
-            if (err.code !== "EPIPE")
-                throw err;
-        });
-    }
-}

package/dist/planner/checks.d.ts

@@ -1,26 +0,0 @@
-import type { PlannerDb } from "./db.js";
-/** Constants, so `PlannerDb.run` never sees a composed string. */
-export declare const CHECK_IDENTITY = "select current_user as who";
-/**
- * `platform.profile` because it exists in every tier and holds real member
- * data in production: the exact rows §3.5 refuses to put behind `main`.
- */
-export declare const CHECK_OVERREACH = "select * from platform.profile limit 1";
-export declare const CHECK_MIGRATIONS = "select count(*)::int as n from supabase_migrations.schema_migrations";
-export interface PlannerVerdict {
-    ok: boolean;
-    /** One line per check, in the order run; the report either way. */
-    lines: string[];
-    /** Set when `ok` is false: what to go and fix. */
-    problem?: string;
-}
-/**
- * Runs the three checks over an OPEN connection; never closes it.
- *
- * Any error from check 2 counts as "cannot read": the interesting distinction
- * is readable versus not, and a role that cannot even enumerate the schema
- * (the validated state) throws just as loudly as one denied on the table.
- */
-export declare function checkPlanner(db: PlannerDb): Promise<PlannerVerdict>;
-/** Postgres 3F000 (invalid_schema_name), with a text fallback. */
-export declare function isMissingSchema(error: unknown): boolean;

package/dist/planner/checks.js

@@ -1,104 +0,0 @@
-/**
- * The three questions that decide whether a connection IS the planner:
- *
- *   1. Who did Postgres authenticate? (`current_user`)
- *   2. Can it read an application schema? (it must not)
- *   3. Can it read the migrations table? (it must, the dry run is next)
- *
- * Shared between `deploy require-planner` (which turns a bad answer into a
- * red CI job) and `planner create` / `planner reset-password` (which run the
- * same checks over a fresh connection before calling the credential done),
- * so "validated working" means the same thing in both places.
- *
- * ⚠️ Check 2 exists because nothing else can catch the mistake it looks for.
- * The preflight `DB_URL` is a value somebody composes by hand, the registry
- * cannot verify it, and a full-access connection string pasted there works
- * identically: the dry run succeeds, `env push` uploads it, `env audit` sees
- * no drift. Reading a `platform.*` table and EXPECTING the permission error
- * is the only observable difference between the right credential and the
- * wrong one.
- */
-import { PLANNER_ROLE } from "./role.js";
-/** Constants, so `PlannerDb.run` never sees a composed string. */
-export const CHECK_IDENTITY = "select current_user as who";
-/**
- * `platform.profile` because it exists in every tier and holds real member
- * data in production: the exact rows §3.5 refuses to put behind `main`.
- */
-export const CHECK_OVERREACH = "select * from platform.profile limit 1";
-export const CHECK_MIGRATIONS = "select count(*)::int as n from supabase_migrations.schema_migrations";
-/**
- * Runs the three checks over an OPEN connection; never closes it.
- *
- * Any error from check 2 counts as "cannot read": the interesting distinction
- * is readable versus not, and a role that cannot even enumerate the schema
- * (the validated state) throws just as loudly as one denied on the table.
- */
-export async function checkPlanner(db) {
-    const lines = [];
-    const [identity] = await db.run(CHECK_IDENTITY);
-    const who = typeof identity?.who === "string" ? identity.who : "";
-    if (who !== PLANNER_ROLE) {
-        return {
-            ok: false,
-            lines,
-            problem: `the connection authenticated as "${who}", not ${PLANNER_ROLE} — ` +
-                "this is a full-privilege connection string where the planner role " +
-                "belongs.",
-        };
-    }
-    lines.push(`authenticated as ${PLANNER_ROLE}`);
-    let overreach = false;
-    try {
-        await db.run(CHECK_OVERREACH);
-        overreach = true;
-    }
-    catch {
-        lines.push("cannot read platform.* (permission denied, as it must be)");
-    }
-    if (overreach) {
-        return {
-            ok: false,
-            lines,
-            problem: `${PLANNER_ROLE} can read platform.profile. The role has grants ` +
-                "beyond the validated pair — drop and re-create it, then re-push " +
-                "the preflight target.",
-        };
-    }
-    try {
-        const [row] = await db.run(CHECK_MIGRATIONS);
-        lines.push(`can read supabase_migrations.schema_migrations (${String(row?.n)} rows)`);
-    }
-    catch (error) {
-        // Two causes share this symptom, and the fix for one is a GRANT while
-        // the fix for the other is initializing the database's migration
-        // history, so the message has to say which. 3F000 is
-        // invalid_schema_name; the text match covers drivers that drop the code.
-        if (isMissingSchema(error)) {
-            return {
-                ok: false,
-                lines,
-                problem: "the supabase_migrations schema does not exist on this database. " +
-                    "The Supabase CLI creates it the first time it records migration " +
-                    "history there (`supabase db push`, or `supabase migration " +
-                    "repair` when baselining an existing database) — until then " +
-                    "there is nothing for the planner to read and nothing for the " +
-                    "dry run to plan against. This is not a grants problem.",
-            };
-        }
-        return {
-            ok: false,
-            lines,
-            problem: `${PLANNER_ROLE} cannot read supabase_migrations.schema_migrations, ` +
-                "so the migration dry run would fail right after this. Re-apply the " +
-                "two grants (see planner/role.ts).",
-        };
-    }
-    return { ok: true, lines };
-}
-/** Postgres 3F000 (invalid_schema_name), with a text fallback. */
-export function isMissingSchema(error) {
-    const e = error;
-    return (e.code === "3F000" ||
-        /schema "?supabase_migrations"? does not exist/i.test(e.message ?? ""));
-}

package/dist/planner/commands.d.ts

@@ -1,10 +0,0 @@
-import { type Connect } from "./db.js";
-export interface PlannerOptions {
-    /** Privileged connection override for the bootstrap case. */
-    dbUrl?: string;
-    connect?: Connect;
-}
-export declare function runPlannerStatus(options?: PlannerOptions): Promise<void>;
-export declare function runPlannerCreate(options?: PlannerOptions): Promise<void>;
-export declare function runPlannerDrop(options?: PlannerOptions): Promise<void>;
-export declare function runPlannerResetPassword(options?: PlannerOptions): Promise<void>;